/ 
Web-Simple-0.034
/ Web::Simple::Deployment
Security Advisories (1)
CVE-2026-114629 (2026-10-24)

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call, with no cap and the return value ignored. Perl's read grows the buffer to the requested length before reading, so the declared Content-Length determines the allocation. An attacker can trigger this through any route whose dispatch specification has a % body-parameter match, such as sub (POST + %name=), sending a Content-Length far larger than the body actually sent. No authentication is involved.

NAME

Web::Simple::Deployment - various deployment options

DESCRIPTION

This file documents common deployment methods for Web::Simple. If you feel one is missing, please ask in the IRC channel and we'll work with you to add it.

CGI

The most basic deployment option is as a CGI script loading and running your Web::Simple-module:

#!/usr/bin/env perl

use Your::Web::Simple::App;
Your::Web::Simple::App->run_if_script;

Save that as script.cgi and your web server will handle it correctly.

Plack-Server

This works in with exactly the same code as CGI deployment. However instead of letting your web server load script.cgi, you run this on the command line:

plackup script.cgi

Self-contained CGI

Sometimes your app is so small that you have only one or two tiny classes that you want to run as a CGI script. Web::Simple offers a helpful mechanism to achieve that.

#!/usr/bin/env perl

use Web::Simple 'HelloWorld';   # enables strictures and warnings for the file
                                # additionally, HelloWorld is upgraded to a
                                # Web::Simple application
{
  package HelloWorld;

  sub dispatch_request {
    sub (GET) {
      [
        200,
        [ 'Content-type', 'text/plain' ],
        [ 'Hello world! It is a fine ' . HelloWorld::Helper->day ]
      ]
    },
    sub () {
      [ 405, [ 'Content-type', 'text/plain' ], [ 'Method not allowed' ] ]
    }
  }
}

{
  package HelloWorld::Helper;

  use DateTime;

  sub day {
    return DateTime->now->day_name;
  }
}

HelloWorld->run_if_script;

AUTHORS

See Web::Simple for authors.

COPYRIGHT AND LICENSE

See Web::Simple for the copyright and license.